CodePen public Pen versus Pro Private Pen for sensitive code

I want to keep HTML, CSS, and JavaScript in a CodePen Pen from being opened by anyone who has the Pen URL. The code contains no server secrets, but it should not appear in public browsing or search results.

CodePen free accounts create Pens as public by default, and there is no free option to make an existing Pen private without changing account type. CodePen Pro offers Private Pens, but current plan terms and enforcement behavior should be confirmed before relying on them. It is unclear whether a Private Pen URL requires authentication on every request or depends on link obscurity alone. Cached copies or search-engine indexes may also remain accessible after visibility changes.

Does a CodePen Pro Private Pen enforce authentication on every request to its URL, or is access controlled by URL obscurity alone? Can a free account change an existing public Pen to private without upgrading? Are cached copies or search-engine indexes removed immediately after switching a Pen from public to private, or is there a documented delay?